MITRE ATT&CK® Framework Mappings
Comprehensive mapping of EDR telemetry features to MITRE ATT&CK data sources. This page provides detailed coverage information and comparisons across different attack techniques.
Process Activity
Techniques related to process activity
Techniques:
- Process CreationProcess CreationDS0009
- Process TerminationProcess TerminationDS0009
- Process AccessProcess AccessDS0009
- Image/Library LoadedModule LoadDS0011
- Remote Thread CreationOS API Execution (Partial)DS0009Process Access (Partial)DS0009
- Process Tampering ActivityProcess ModificationDS0009
File Manipulation
Techniques related to file manipulation
Techniques:
- File CreationFile CreationDS0022
- File OpenedFile OpenedDS0022
- File DeletionFile DeletionDS0022
- File ModificationFile ModificationDS0022
- File RenamingFile RenamingDS0022
User Account Activity
Techniques related to user account activity
Techniques:
- Local Account CreationLocal Account CreationDS0002
- Local Account ModificationLocal Account ModificationDS0002
- Local Account DeletionLocal Account DeletionDS0002
- Account LoginAccount Login (User Account Authentication)DS0002Account Login (Logon Session Creation)DS0028
- Account LogoffNo mapping available
Network Activity
Techniques related to network activity
Techniques:
- TCP ConnectionTCP ConnectionDS0029
- UDP ConnectionUDP ConnectionDS0029
- URLURLDS0029
- DNS QueryDNS QueryDS0029
- File DownloadedFile Downloaded (Network Traffic Content)DS0029File Downloaded (File Creation)DS0022
Hash Algorithms
Techniques related to hash algorithms
Techniques:
- MD5MD5DS0022
- SHASHADS0022
- IMPHASHIMPHASHDS0022
Registry Activity
Techniques related to registry activity
Techniques:
- Key/Value CreationKey/Value CreationDS0024
- Key/Value ModificationKey/Value ModificationDS0024
- Key/Value DeletionKey/Value DeletionDS0024
Schedule Task Activity
Techniques related to schedule task activity
Techniques:
- Scheduled Task CreationScheduled Task CreationDS0003
- Scheduled Task ModificationScheduled Task ModificationDS0003
- Scheduled Task DeletionScheduled Task DeletionDS0003
Service Activity
Techniques related to service activity
Techniques:
- Service CreationService CreationDS0019
- Service ModificationService ModificationDS0019
- Service DeletionService DeletionDS0019
Driver/Module Activity
Techniques related to driver/module activity
Techniques:
- Driver LoadedDriver LoadedDS0027
- Driver ModificationDriver ModificationDS0022
- Driver UnloadedNo mapping available
Device Operations
Techniques related to device operations
Techniques:
- Virtual Disk MountVirtual Disk MountDS0016
- USB Device UnmountUSB Device UnmountDS0016
- USB Device MountUSB Device MountDS0016
Other Relevant Events
Techniques related to other relevant events
Techniques:
- Group Policy ModificationGroup Policy ModificationDS0026
Named Pipe Activity
Techniques related to named pipe activity
Techniques:
- Pipe CreationPipe CreationDS0023
- Pipe ConnectionPipe ConnectionDS0023
EDR SysOps
Techniques related to edr sysops
Techniques:
- Agent StartAgent StartDS0013
- Agent StopAgent StopDS0013
- Agent InstallAgent InstallDS0013
- Agent UninstallAgent UninstallDS0013
- Agent Keep-AliveAgent Keep-AliveDS0013
- Agent ErrorsAgent ErrorsDS0013
WMI Activity
Techniques related to wmi activity
Techniques:
- WmiEventConsumerToFilterWmiEventConsumerToFilterDS0005
- WmiEventConsumerWmiEventConsumerDS0005
- WmiEventFilterWmiEventFilterDS0005
BIT JOBS Activity
Techniques related to bit jobs activity
Techniques:
- BIT JOBS ActivityPowerShell ActivityDS0012PowerShell ActivityDS0017
PowerShell Activity
Techniques related to powershell activity
Techniques:
- Script-Block ActivityScript-Block ActivityDS0012